Overview

overview

9

Static

static

1

Kaspersky4...us.exe

windows11-21h2-x64

9

Analysis

  • user interaction
    yes
  • max time kernel
    115s
  • max time network
    143s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    20/08/2026, 04:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Kaspersky4Win_21.26.4.406_Rus.exe
  • Size 587.5MB
  • Sample260820-esp6nsbc98
  • SHA256 456905cd60df7c0e81ac0ed62b6048bc46bfceb44ac27fb226ae2e0f861f834a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    defense_evasion
  • Drops file in Drivers directory 6 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 3 IoCs
    defense_evasion
  • Looks for Xen service registry key. 1 TTPs 5 IoCs
    defense_evasion
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks for any installed AV software in registry 1 TTPs 64 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Windows directory 36 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 63 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 2 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 10 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Kaspersky4Win_21.26.4.406_Rus.exe
    "C:\Users\Admin\AppData\Local\Temp\Kaspersky4Win_21.26.4.406_Rus.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Windows\temp\4D65BBCBD4C91F1169DE2589FBC2356C\Kaspersky4Win_21.26.4.406_Rus.exe
      "C:\Windows\temp\4D65BBCBD4C91F1169DE2589FBC2356C\Kaspersky4Win_21.26.4.406_Rus.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\Kaspersky4Win_21.26.4.406_Rus.exe"
      2⤵
      • Enumerates VirtualBox registry keys
      • Looks for VMWare Tools registry key
      • Looks for VMWare services registry key.
      • Looks for Xen service registry key.
      • Checks for any installed AV software in registry
      • Drops file in Windows directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Checks SCSI registry key(s)
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:788
      • C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\setup_ui.exe
        "C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\setup_ui.exe" -cp=objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAADzb8j90/lYq6UWTWhooWrfAmgAABQD//9zByldJhRWSy8AGQAHAFoAaABuAG4AawBqAHIAbAAAAAcAMQAwAC4AMQAyADcALgAwAC4AMQAxADkAAAAAAAkA//8AAB4A//8AABAA//8AAAoA//8AABYA//8AAB8A//8AAA4A//8AAAAA:
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4852
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\D5EFD6B0-9C4D-11F1-96ED-5298BF2C53C6\GetSI.dll",SaveReportRunDllEntry "C:\Users\Admin\AppData\Local\Temp\D5EFD6B0-9C4D-11F1-96ED-5298BF2C53C6\D5EFD6B1-9C4D-11F1-96ED-5298BF2C53C6"
        3⤵
        • Checks for any installed AV software in registry
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        PID:2432
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://click.kaspersky.com/?hl=ru-RU&customization=&version=21.26.4.406&pid=234-Win&syst=Microsoft Windows 11 x64 Edition (build 22000)&error=29100&link=AntiMalwareTools
        3⤵
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1124
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x36c,0x7fffd505c188,0x7fffd505c194,0x7fffd505c1a0
          4⤵
            PID:1072
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,8615711610186698651,12285213139745401344,524288 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:11
            4⤵
            • System Time Discovery
            PID:3472
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,8813194713107256197,9466445182057438473,524288 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:13
            4⤵
              PID:4468
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,451899768035482963,16145035754632385438,262144 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:2
              4⤵
                PID:2392
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3324,i,7165015544435855073,13916904776013014090,2097152 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
                4⤵
                  PID:4548
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3328,i,4484438893636637550,9832329307514739012,2097152 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
                  4⤵
                    PID:1724
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4012,i,10163129773230107968,5658159846578910842,2097152 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:1
                    4⤵
                      PID:240
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4052,i,13834846609634137937,14227818972443110333,2097152 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:9
                      4⤵
                        PID:868
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4128,i,4237273370279475940,14720001346522519049,2097152 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
                        4⤵
                          PID:1804
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4048,i,2042831604880344544,6265634843284828678,2097152 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
                          4⤵
                            PID:3532
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,12613948267761875579,13054496994357111775,524288 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:14
                            4⤵
                              PID:4264
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5296,i,2802522735855052231,2054270203536650193,2097152 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
                              4⤵
                                PID:1348
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,17824381032065922803,5164557319818783571,524288 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
                                4⤵
                                  PID:3636
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5700,i,11670498023426051261,6912906626304103960,2097152 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
                                  4⤵
                                    PID:4128
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5852,i,18384491140693293779,11928446153444459633,2097152 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
                                    4⤵
                                      PID:3924
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,4985940635044167059,10158325069384878141,524288 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:14
                                      4⤵
                                        PID:4812
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,17967374490690947076,10194498952861814156,524288 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
                                        4⤵
                                          PID:568
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,2133297545078075483,11628220036716584563,524288 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:14
                                          4⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2252
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                            cookie_exporter.exe --cookie-json=1128
                                            5⤵
                                              PID:2104
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,3355591445856480343,12733637310421063207,524288 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
                                            4⤵
                                              PID:5264
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,3355591445856480343,12733637310421063207,524288 --field-trial-handle=2616,i,8359669153102402973,6323785073358668634,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
                                              4⤵
                                                PID:5272
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://click.kaspersky.com/?hl=ru-RU&customization=&version=21.26.4.406&pid=234-Win&syst=Microsoft Windows 11 x64 Edition (build 22000)&error=29100&link=AntiMalwareTools
                                              3⤵
                                                PID:3816
                                              • C:\Windows\temp\4D65BBCBD4C91F1169DE2589FBC2356C\Kaspersky4Win_21.26.4.406_Rus.exe
                                                "C:\Windows\temp\4D65BBCBD4C91F1169DE2589FBC2356C\Kaspersky4Win_21.26.4.406_Rus.exe" -cleanup="C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C;788"
                                                3⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:4220
                                          • C:\Windows\system32\msiexec.exe
                                            C:\Windows\system32\msiexec.exe /V
                                            1⤵
                                            • Badlisted process makes network request
                                            • Checks for any installed AV software in registry
                                            • Enumerates connected drives
                                            • Drops file in Windows directory
                                            • Modifies data under HKEY_USERS
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:984
                                            • C:\Windows\syswow64\MsiExec.exe
                                              C:\Windows\syswow64\MsiExec.exe -Embedding D86D7608482266506E7ED39F7A071D73
                                              2⤵
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:4508
                                            • C:\Windows\syswow64\MsiExec.exe
                                              C:\Windows\syswow64\MsiExec.exe -Embedding AC57C9C5CDA2C990B3A72DF62AB4E88A E Global\MSI0000
                                              2⤵
                                              • Checks for any installed AV software in registry
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4144
                                            • C:\Windows\System32\MsiExec.exe
                                              C:\Windows\System32\MsiExec.exe -Embedding 4C556477BDD8AD35F50503053782BDD8 E Global\MSI0000
                                              2⤵
                                              • Drops file in Drivers directory
                                              • Drops file in Windows directory
                                              • Loads dropped DLL
                                              PID:4104
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                            1⤵
                                              PID:2168
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                              1⤵
                                              • Enumerates system info in registry
                                              • Modifies data under HKEY_USERS
                                              • Modifies registry class
                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              • Suspicious use of WriteProcessMemory
                                              PID:3008
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7fffd505c188,0x7fffd505c194,0x7fffd505c1a0
                                                2⤵
                                                  PID:5180
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1720,i,5197854450709282572,3410959104910706248,524288 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
                                                  2⤵
                                                  • System Time Discovery
                                                  PID:3080
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,6181000347908442856,12579361126443660403,262144 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
                                                  2⤵
                                                    PID:5388
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,7377106219950513209,915115120775999781,524288 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:13
                                                    2⤵
                                                      PID:5324
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,401144271666576134,1876877108754257571,2097152 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
                                                      2⤵
                                                        PID:5640
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,18403484612206841865,2596918876361924256,2097152 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
                                                        2⤵
                                                          PID:5644
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,3267703950892299321,3667112768244264155,524288 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
                                                          2⤵
                                                            PID:4800
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,6401884979713616685,18065503726301408506,524288 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
                                                            2⤵
                                                              PID:5876
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5264,i,6910857993445400917,4932337173955286319,2097152 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
                                                              2⤵
                                                                PID:6116
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,325294252087609160,10191191544156355323,524288 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
                                                                2⤵
                                                                  PID:5144
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,11983684573460519095,16468869250443827811,524288 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
                                                                  2⤵
                                                                    PID:2532
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,2346285524996028478,10041181512634886395,524288 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
                                                                    2⤵
                                                                      PID:4620
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,8292057096125693341,17928784639138118923,524288 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
                                                                      2⤵
                                                                        PID:5072
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,8292057096125693341,17928784639138118923,524288 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
                                                                        2⤵
                                                                          PID:4672
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,17960840687351444712,530992378744708693,524288 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
                                                                          2⤵
                                                                            PID:6048
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,7560254575901116309,264213655090997443,524288 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
                                                                            2⤵
                                                                              PID:5132
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,4215917754959817464,2302159686795011221,524288 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
                                                                              2⤵
                                                                                PID:1500
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,8677423342969458915,15847499756023683484,524288 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
                                                                                2⤵
                                                                                  PID:4268
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6776,i,11144509140049362423,3395241381066217509,2097152 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
                                                                                  2⤵
                                                                                    PID:2168
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,9538576172973194166,14469937493982581781,524288 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
                                                                                    2⤵
                                                                                      PID:6020
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6688,i,12752830079099051356,12465949915433867184,2097152 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
                                                                                      2⤵
                                                                                        PID:232
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6636,i,1825115643383641803,15564078490306356437,2097152 --field-trial-handle=2060,i,3736790926878189449,8454316174232085653,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
                                                                                        2⤵
                                                                                          PID:3144
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                          2⤵
                                                                                          • Enumerates system info in registry
                                                                                          • Modifies data under HKEY_USERS
                                                                                          • Modifies registry class
                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                          PID:5880
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7fffd505c188,0x7fffd505c194,0x7fffd505c1a0
                                                                                            3⤵
                                                                                              PID:5848
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,4032990514364051492,3587761199193872671,524288 --field-trial-handle=2144,i,4458886627031095620,1233901042084532228,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:11
                                                                                              3⤵
                                                                                              • System Time Discovery
                                                                                              PID:3576
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,11213596388556794676,2550774151954935537,262144 --field-trial-handle=2144,i,4458886627031095620,1233901042084532228,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
                                                                                              3⤵
                                                                                                PID:6116
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,10116787534936980319,14491093332201611803,524288 --field-trial-handle=2144,i,4458886627031095620,1233901042084532228,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:13
                                                                                                3⤵
                                                                                                  PID:5164
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,17595439591705396986,5659304493555907653,524288 --field-trial-handle=2144,i,4458886627031095620,1233901042084532228,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
                                                                                                  3⤵
                                                                                                    PID:3296
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,17595439591705396986,5659304493555907653,524288 --field-trial-handle=2144,i,4458886627031095620,1233901042084532228,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
                                                                                                    3⤵
                                                                                                      PID:1532
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4860,i,14706969515477242827,11809146448052226625,2097152 --field-trial-handle=2144,i,4458886627031095620,1233901042084532228,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
                                                                                                      3⤵
                                                                                                        PID:5656
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,7497737157269138971,17258633755978767011,524288 --field-trial-handle=2144,i,4458886627031095620,1233901042084532228,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
                                                                                                        3⤵
                                                                                                          PID:5664
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,4827664102556475999,3485929977331842838,524288 --field-trial-handle=2144,i,4458886627031095620,1233901042084532228,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
                                                                                                          3⤵
                                                                                                            PID:5544
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5588,i,5216804673474430078,4696854225333722092,2097152 --field-trial-handle=2144,i,4458886627031095620,1233901042084532228,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
                                                                                                            3⤵
                                                                                                              PID:3092
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,9429724695063504822,9913435793713449037,524288 --field-trial-handle=2144,i,4458886627031095620,1233901042084532228,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
                                                                                                              3⤵
                                                                                                                PID:6088
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,219709022146454967,1358149924796293423,524288 --field-trial-handle=2144,i,4458886627031095620,1233901042084532228,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
                                                                                                                3⤵
                                                                                                                  PID:6076
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,8104716210119397508,10714084125329738105,524288 --field-trial-handle=2144,i,4458886627031095620,1233901042084532228,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
                                                                                                                  3⤵
                                                                                                                    PID:6072
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                1⤵
                                                                                                                  PID:5532
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                  1⤵
                                                                                                                    PID:5292
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                    1⤵
                                                                                                                      PID:3640

                                                                                                                    Network

                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          kdscrl.rdb
                                                                                                                          • Path C:\ProgramData\Kaspersky Lab Setup Files\KIS21.26.4.406.0.2.0\BD8F8866-9C4D-11F1-96ED-5298BF2C53C6\kdscrl.rdb
                                                                                                                          • Size 3KB
                                                                                                                          • SHA256 e6c0da20fc5d9eda24e4128faa5641f8b2d39951e0a0236c013e1f1efcbf83fd
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          kleaner.pack
                                                                                                                          • Path C:\ProgramData\Kaspersky Lab Setup Files\KIS21.26.4.406.0.2.0\BD8F8866-9C4D-11F1-96ED-5298BF2C53C6\kleaner.pack
                                                                                                                          • Size 5.4MB
                                                                                                                          • SHA256 64f08ba0391ad00a0719f5ed00aa4aa6df0c475c544a4af771f3971559a5d66b
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          netcoredistr_8_x86.z
                                                                                                                          • Path C:\ProgramData\Kaspersky Lab Setup Files\KIS21.26.4.406.0.2.0\BD8F8866-9C4D-11F1-96ED-5298BF2C53C6\netcoredistr_8_x86.z
                                                                                                                          • Size 25.7MB
                                                                                                                          • SHA256 2aa00d51fdafbbf2cfa5d818f2b3bbdadc650ba481dd7c4c0387250dd647b814
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          product.cab
                                                                                                                          • Path C:\ProgramData\Kaspersky Lab Setup Files\KIS21.26.4.406.0.2.0\BD8F8866-9C4D-11F1-96ED-5298BF2C53C6\product.cab
                                                                                                                          • Size 4.2MB
                                                                                                                          • SHA256 3cc07c915e563b75037e17f4727ac02cb515563f39e312dcde8cbbe633de5dce
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          product.msi
                                                                                                                          • Path C:\ProgramData\Kaspersky Lab Setup Files\KIS21.26.4.406.0.2.0\BD8F8866-9C4D-11F1-96ED-5298BF2C53C6\product.msi
                                                                                                                          • Size 17.8MB
                                                                                                                          • SHA256 cfab323101900c6a4ad09b2a3daf029a15a371928d006833b78da2cf7a36ac01
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          x64.cab
                                                                                                                          • Path C:\ProgramData\Kaspersky Lab Setup Files\KIS21.26.4.406.0.2.0\BD8F8866-9C4D-11F1-96ED-5298BF2C53C6\x64.cab
                                                                                                                          • Size 3.5MB
                                                                                                                          • SHA256 adaaefd59162858187cbc9124dee2c0fdb6283e5c483a9b29a52da313219f382
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          kl-install-2026-08-20-05-15-29_KIS.21.26.4.406.log
                                                                                                                          • Path C:\ProgramData\Kaspersky Lab Setup Files\KIS21.26.4.406.0.2.0\D5EFD6B2-9C4D-11F1-96ED-5298BF2C53C6\kl-install-2026-08-20-05-15-29_KIS.21.26.4.406.log
                                                                                                                          • Size 1.3MB
                                                                                                                          • SHA256 6d5fa68335ba0b251b827a50027c2844d52741369951b32b8bf392a7e39ce84e
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          kl-setup-2026-08-20-05-15-14_KIS.21.26.4.406.log
                                                                                                                          • Path C:\ProgramData\Kaspersky Lab Setup Files\KIS21.26.4.406.0.2.0\D5EFD6B2-9C4D-11F1-96ED-5298BF2C53C6\kl-setup-2026-08-20-05-15-14_KIS.21.26.4.406.log
                                                                                                                          • Size 2.7MB
                                                                                                                          • SHA256 5b72cb793b44503f09766d7644c9bb986e9b17a0061ec98249fd031c266693ed
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          kleaner.pack
                                                                                                                          • Path C:\ProgramData\Kaspersky Lab Setup Files\KIS21.26.4.406.0.2.0\kleaner.pack
                                                                                                                          • Size 5.4MB
                                                                                                                          • SHA256 46ab360ce9ace1fb12d6cdbabb0ab7aee4b4b2bcbe6d23696d5bfcc6d45fc9ec
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          95063845-1401-430f-8ba4-5ee00b0ca521.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\95063845-1401-430f-8ba4-5ee00b0ca521.tmp
                                                                                                                          • Size 18KB
                                                                                                                          • SHA256 b79c472ba7efaf9e8a6a228b2e7642a48d233e365d15d9e6dc167089fdf7b890
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          settings.dat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                          • Size 280B
                                                                                                                          • SHA256 b83a3942afcad90c82099ba03215a59597aae59494f83e9f44b35394472083cc
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          settings.dat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                          • Size 280B
                                                                                                                          • SHA256 89ab71a3a4e732da8cbbe2e13ba149e13c94226b7119c8a0598106b99907544f
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          settings.dat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                          • Size 280B
                                                                                                                          • SHA256 dcfc4c476f41db2d6042449b7b855b9751140e2127be8e8208aafd46a5893b7d
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          settings.dat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                          • Size 280B
                                                                                                                          • SHA256 591fa12c9d2e76c187c871381d49ffd17760a6d3e15a295d501ecef3e4bcb4bb
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          settings.dat
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                          • Size 280B
                                                                                                                          • SHA256 0c79fd9623ceff0bea1e86a1983c46c050da9b039460d42851bc69ee9237670d
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          296b0589-3768-45b5-aef3-abdb4a4b06e1.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\296b0589-3768-45b5-aef3-abdb4a4b06e1.tmp
                                                                                                                          • Size 414B
                                                                                                                          • SHA256 e74c1a9683550b669e77b78196682c48a1a554f43f7a79f3ea6f5fac21925883
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          BookmarkMergedSurfaceOrdering
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                          • Size 6B
                                                                                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          temp-index
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                          • Size 5KB
                                                                                                                          • SHA256 5af884409b7238506d0ffb5417dd27c5a6e54b2ee035029a844b97b34ff172e1
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          the-real-index
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                          • Size 3KB
                                                                                                                          • SHA256 6fa991e0a2b7cd8df1164c3a6a802400f8877b277759093511d1c134b88dd7b2
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          the-real-index
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                          • Size 6KB
                                                                                                                          • SHA256 d50a601d357edb74a72d1f9199315c2398f1b4a1d9372e8b2a96ee0306a1ef3e
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          the-real-index~RFe5953f2.TMP
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5953f2.TMP
                                                                                                                          • Size 3KB
                                                                                                                          • SHA256 b7cd49012548157e1c50d571fea9cb7b24dabcdaf19c5f7e32e5669d8d4f49bd
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          SiteList-Enterprise.json
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                          • Size 2B
                                                                                                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          Edge Profile.ico
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                          • Size 70KB
                                                                                                                          • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          CURRENT
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
                                                                                                                          • Size 16B
                                                                                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          Network Persistent State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                          • Size 3KB
                                                                                                                          • SHA256 de3256a5bb3526e4e194a33c0a1e0016266ccb87fae41f32ad476f43476f6b5e
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          Network Persistent State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                          • Size 6KB
                                                                                                                          • SHA256 8f02ea1d312d0c98b0d227bd524a70df9407cd4cf92b168fe55a36fc50241bcd
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          SCT Auditing Pending Reports
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                          • Size 2B
                                                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          TransportSecurity
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
                                                                                                                          • Size 2KB
                                                                                                                          • SHA256 6d23cd6ac3c130d400fc29e1eb03873f65be0b109a66c30878b029a0c507ed27
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          b71cb883-995c-445a-acba-fb91801cf8ff.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b71cb883-995c-445a-acba-fb91801cf8ff.tmp
                                                                                                                          • Size 40B
                                                                                                                          • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          Preferences
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                          • Size 14KB
                                                                                                                          • SHA256 9844cd88494da54056d8120c686e7a57af7d0c24e24dfd81025cc74649206e80
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Preferences
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                          • Size 16KB
                                                                                                                          • SHA256 ebad9fd54c630db13c221848a8857a26b148d95e8641dbe9aa19c04b5986e0c4
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Preferences
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                          • Size 17KB
                                                                                                                          • SHA256 057f5282cd475c7eeea4029bb34f99df125b9a1d2680b545391e5eecbe5a9227
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Secure Preferences
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                          • Size 31KB
                                                                                                                          • SHA256 7145de89c936fa070ab3a85d35b048ad584c50a614f41d8c2a0cb3b75c952ee7
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          the-real-index
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\137a11f5-d8a2-470d-92c2-557d26834bc1\index-dir\the-real-index
                                                                                                                          • Size 72B
                                                                                                                          • SHA256 3e99e9064b5a925498511f7d1ccbfad8c6c2ad9b95156b0f6c2442ffe24dab7c
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          the-real-index
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1ce2ee2b-64a5-4468-95e6-6797f9e657f2\index-dir\the-real-index
                                                                                                                          • Size 1KB
                                                                                                                          • SHA256 71d849bdc304dc32074caf1bae91822d2fc6fdc35cf7711cf92b49f43d08c9c0
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          the-real-index
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1ce2ee2b-64a5-4468-95e6-6797f9e657f2\index-dir\the-real-index
                                                                                                                          • Size 3KB
                                                                                                                          • SHA256 575146a90e2fdd8c9a43c768fe464269ef8afd93c765b694c86f804db9698f86
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          the-real-index~RFe597f58.TMP
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1ce2ee2b-64a5-4468-95e6-6797f9e657f2\index-dir\the-real-index~RFe597f58.TMP
                                                                                                                          • Size 1KB
                                                                                                                          • SHA256 74996f808e69c33e828458b243bba8947f569d79b3c49077ac7800cbc2f6b722
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          the-real-index
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\750c52cd-5fdf-4335-805f-df07c3d4e54c\index-dir\the-real-index
                                                                                                                          • Size 72B
                                                                                                                          • SHA256 befdddbe6c92bc2c1e0f680caaf8dc35a26fda9ae944942f18dbafe8f89f73e6
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          the-real-index~RFe5a29d0.TMP
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\750c52cd-5fdf-4335-805f-df07c3d4e54c\index-dir\the-real-index~RFe5a29d0.TMP
                                                                                                                          • Size 48B
                                                                                                                          • SHA256 33c340fa0ff6bf22faa6f612569f41846d480bd64276f023fecd79b9bae831fa
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          the-real-index
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ea593a03-30b5-4191-a062-c6773b7e541d\index-dir\the-real-index
                                                                                                                          • Size 72B
                                                                                                                          • SHA256 60890988678647857d04d5620535827d9503514990c0e8a5971ed3f6a10bbdb0
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          the-real-index
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ea593a03-30b5-4191-a062-c6773b7e541d\index-dir\the-real-index
                                                                                                                          • Size 72B
                                                                                                                          • SHA256 a2af1bec155a3fb062f3192bba92bfa277caa9ffbdd40a0e1b40714a27b68b93
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          index.txt
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                          • Size 476B
                                                                                                                          • SHA256 5076e9a8b2eebb26dff4923e72dd8b63e0568cf5b6f904d9cbb49f9a1cee45a1
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          index.txt
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                          • Size 481B
                                                                                                                          • SHA256 a203489f39e574c480bd5f2bc7b04901a380158326f7598869c3ecd8eeb6ad98
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          index.txt
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                          • Size 371B
                                                                                                                          • SHA256 d046c1d2d7306c80fcc491c32563b0f8973f05c7859b1a4a1bdbe7e8dc72d0fb
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          the-real-index
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                          • Size 72B
                                                                                                                          • SHA256 e6ecae6ffc451f0223d314d09c5dfd768027c9ec93e573fa87c2d1c15ccf7846
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          the-real-index~RFe59baab.TMP
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59baab.TMP
                                                                                                                          • Size 48B
                                                                                                                          • SHA256 de14e6c0708a2468e085298b9c493df8504f3c7356b10b3b2a8f203add2d3c11
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          sync_diagnostic.log
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                          • Size 4KB
                                                                                                                          • SHA256 2e4b40c9da650af7f518e38d0bff1142f10c4ebac69e7b7653cba9dc4dfa78a0
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 17KB
                                                                                                                          • SHA256 c19a72429244ed62718ebf13dc957f875691d447097b3af9167cc04a7bdf6639
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 24KB
                                                                                                                          • SHA256 eefa52618667bb52a593fe244951dba2fa6eadd33575a6830b02549822cc7563
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 12KB
                                                                                                                          • SHA256 f6423edebd3c55d39d0aa1c248f06e458da163ea9400e4435b5f8f5a8a32b62f
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 8KB
                                                                                                                          • SHA256 d1e1b60656fde87fe08552593d2dda947887a7463624323b45c314a9ae352d82
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 13KB
                                                                                                                          • SHA256 aea1e4059850a803665459eaf5d48e2d67419b95446402dd4d85316ddd9eafde
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          Local State
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                          • Size 8KB
                                                                                                                          • SHA256 080e4cd30198bd5d4cc10921d232a365b47ccba19fcc2261d9f2a094213d4f94
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          data_1
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                                                                                          • Size 264KB
                                                                                                                          • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                          Submit Download

                                                                                                                          236375d1-808c-438d-b681-2225d35bdbe5.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\236375d1-808c-438d-b681-2225d35bdbe5.tmp
                                                                                                                          • Size 13B
                                                                                                                          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          kl.setup.ui.core.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\kl.setup.ui.core.dll
                                                                                                                          • Size 87KB
                                                                                                                          • SHA256 f0ab85fcf3d01fa5def51aa2c083067b4f2b775ae079bf3456e5eb93316d7165
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          kl.setup.ui.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\kl.setup.ui.dll
                                                                                                                          • Size 318KB
                                                                                                                          • SHA256 c504f09b8ad000a62dd452a156ca3263a6756b2ba67b781ccb66d56553f8e359
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          kl.setup.ui.interoplayer.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\kl.setup.ui.interoplayer.dll
                                                                                                                          • Size 58KB
                                                                                                                          • SHA256 b7bd6823029ff048424721532c46cd09748aca3ed0ce493b176d1dd75624662d
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          kl.setup.ui.visuals.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\kl.setup.ui.visuals.dll
                                                                                                                          • Size 149KB
                                                                                                                          • SHA256 b4d0a4718bb89bb515df3e2a274b856f86ca457fc3e8f159ed142e95bf6d4749
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          kl.ui.framework.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\kl.ui.framework.dll
                                                                                                                          • Size 414KB
                                                                                                                          • SHA256 4794caaf8c17ab9d2f7a112e7d3571ad2c261694d2cb77fec3ea7cc548eb2727
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          kl.ui.framework.uikit.b2c.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\kl.ui.framework.uikit.b2c.dll
                                                                                                                          • Size 725KB
                                                                                                                          • SHA256 50d4e213709d856325f977f9c47ae980997e1e2de029a42eae9441a471b06f62
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          kl.ui.framework.uikit.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\kl.ui.framework.uikit.dll
                                                                                                                          • Size 3.8MB
                                                                                                                          • SHA256 138db9cb4136f86dab39389722d2f8229dbacd1d6d66ca620d46bdbac4c46298
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          kl.ui.framework.uikit.media.setup.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\kl.ui.framework.uikit.media.setup.dll
                                                                                                                          • Size 270KB
                                                                                                                          • SHA256 4ab27c25d29909e41dce674882a23b584c1e86128ebdfb4cb86a8bb26511ac38
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          setup.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\setup.dll
                                                                                                                          • Size 11.3MB
                                                                                                                          • SHA256 7248b4206c311087e5ce8b40f96f63c11fd93df3d55001246dd573fb374164a4
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          setup_ui.exe
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\setup_ui.exe
                                                                                                                          • Size 810KB
                                                                                                                          • SHA256 b42a4e9f659ccee3660da3583bbb4f67e70cb905472502b593ae8b0a28e07b00
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          sharpvectorconverterswpf.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\sharpvectorconverterswpf.dll
                                                                                                                          • Size 110KB
                                                                                                                          • SHA256 a14afd1ffd2dcae3e40d305d1022d7778ec72362ef6ba72f31edf2822cccaa55
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          sharpvectorcore.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\sharpvectorcore.dll
                                                                                                                          • Size 204KB
                                                                                                                          • SHA256 34b4a06d4d0e6918f1e37f4b89fade3c88adc2edf3fc234cb949446c549cabfa
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          sharpvectorcss.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\sharpvectorcss.dll
                                                                                                                          • Size 124KB
                                                                                                                          • SHA256 bc2a4c296fe27b181c7e024da9293908370face48ae6ec62791eae3e8eb92383
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          sharpvectordom.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\sharpvectordom.dll
                                                                                                                          • Size 61KB
                                                                                                                          • SHA256 ec4b01912520dcdaf6842ee16faa086a73e1350830d47c35e217361a8821b693
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          sharpvectormodel.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\sharpvectormodel.dll
                                                                                                                          • Size 720KB
                                                                                                                          • SHA256 014340a1840cb79c9fe5cd21a324a4436390a0037fb602fe65db80603ad20261
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          sharpvectorrenderingwpf.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\sharpvectorrenderingwpf.dll
                                                                                                                          • Size 287KB
                                                                                                                          • SHA256 67f5702d1947fb7cef5d03d751493f98ac67942ee0d4f6b314ea0f45dc9144a0
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          sharpvectorruntimewpf.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\3688F8DBD4C91F1169DE2589FBC2356C\sharpvectorruntimewpf.dll
                                                                                                                          • Size 85KB
                                                                                                                          • SHA256 de72dcaab3ebb9db2ad86f3c574e8070bc84b8a62ef11b1e2d8ca5c691337f0b
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          55a749b0-1775-4c63-8ed5-524678d77e3a.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\55a749b0-1775-4c63-8ed5-524678d77e3a.tmp
                                                                                                                          • Size 1B
                                                                                                                          • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                          Submit Download

                                                                                                                          yandex-logo.png
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\BD8F8865-9C4D-11F1-96ED-5298BF2C53C6\yandex-logo.png
                                                                                                                          • Size 10KB
                                                                                                                          • SHA256 1f9bbad0dacaab3b0ad5da494ce69cd4eb042aeecd5a33842f5f5523fc651b65
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          cleanapi.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\C5F14B0A-9C4D-11F1-96ED-5298BF2C53C6\Cleaner\cleanapi.dll
                                                                                                                          • Size 3.2MB
                                                                                                                          • SHA256 8335292547841e17f6de79711cbf99d88d832d9509faadee713142eb30054f99
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          cbi.dll_x86
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\C5F14B0B-9C4D-11F1-96ED-5298BF2C53C6\cbi.dll_x86
                                                                                                                          • Size 133KB
                                                                                                                          • SHA256 008c7cb5730d5703579addcbb851778f029f8cb9ebff95215b0088522b81d1bd
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          e0be2975-2c09-4ac9-839a-fbefcdf65cbd.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\e0be2975-2c09-4ac9-839a-fbefcdf65cbd.tmp
                                                                                                                          • Size 154KB
                                                                                                                          • SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          kl-install-2026-08-20-05-15-29_KIS.21.26.4.406.log
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\kl-install-2026-08-20-05-15-29_KIS.21.26.4.406.log
                                                                                                                          • Size 1KB
                                                                                                                          • SHA256 792393d7e86620b347eed64fa7033d3620a29b2399d9d15376908ea5bde26dfb
                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                          Submit Download

                                                                                                                          content_new.js
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3008_2121983453\CRX_INSTALL\content_new.js
                                                                                                                          • Size 10KB
                                                                                                                          • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          fe1618f9-e2d8-48d6-aad3-520cb8936eea.tmp
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3008_2121983453\fe1618f9-e2d8-48d6-aad3-520cb8936eea.tmp
                                                                                                                          • Size 10KB
                                                                                                                          • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          msi_common.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\{1CA24E05-652F-4B6B-8B06-E6CDC7B02B11}\msi_common.dll
                                                                                                                          • Size 662KB
                                                                                                                          • SHA256 b8648b78afead566039e158d5943c9f416e8e9a5c6fa78aceaf08f59bbfce43d
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          product_info.dll
                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\{1CA24E05-652F-4B6B-8B06-E6CDC7B02B11}\product_info.dll
                                                                                                                          • Size 274KB
                                                                                                                          • SHA256 d6c42102318997c7c83402271e2c1f74b0010ea323ce1e3d83cdb96294bf58a7
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          MSIC196.tmp
                                                                                                                          • Path C:\Windows\Installer\MSIC196.tmp
                                                                                                                          • Size 180KB
                                                                                                                          • SHA256 a458226150f53130b509d7cf43eb81b51718ec0dd3ea497c01099c465a192637
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          MSIC206.tmp
                                                                                                                          • Path C:\Windows\Installer\MSIC206.tmp
                                                                                                                          • Size 2.6MB
                                                                                                                          • SHA256 170a4071e4a86017e765a28de3db49b8cd2a99a474059cc9d61fe20417d07166
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          MSIDCEC.tmp
                                                                                                                          • Path C:\Windows\Installer\MSIDCEC.tmp
                                                                                                                          • Size 716KB
                                                                                                                          • SHA256 1f4a20135b743b480e14c55dc8f9207488354b5d17c630436c37d3113f96406c
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          OLD1ED9.tmp
                                                                                                                          • Path C:\Windows\Temp\OLD1ED9.tmp
                                                                                                                          • Size 1.5MB
                                                                                                                          • SHA256 7ed282d77f5a43905efcebe5733164db62d01a24830551788943dd1abbed9ea9
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          OLD1EE9.tmp
                                                                                                                          • Path C:\Windows\Temp\OLD1EE9.tmp
                                                                                                                          • Size 699KB
                                                                                                                          • SHA256 1b6a88a401b7392e35a2d638350fcdc7d880eec8d36519f50fe41568373ecd2f
                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                          Submit Download

                                                                                                                          memory/788-8-0x0000000077CB0000-0x0000000077CC0000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/788-7-0x0000000077CB0000-0x0000000077CC0000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/788-6-0x0000000077CB0000-0x0000000077CC0000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1676-2-0x0000000077CA0000-0x0000000077CB0000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1676-1-0x0000000077CA0000-0x0000000077CB0000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/1676-0-0x0000000077CA0000-0x0000000077CB0000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4220-2455-0x0000000077CC0000-0x0000000077CD0000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4220-2456-0x0000000077CC0000-0x0000000077CD0000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4220-2457-0x0000000077CC0000-0x0000000077CD0000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-89-0x00000000069B0000-0x00000000069D6000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-78-0x0000000005980000-0x0000000005996000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-129-0x000000000B830000-0x000000000B874000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-118-0x0000000007830000-0x00000000078E4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-122-0x00000000076F0000-0x0000000007710000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-707-0x0000000000140000-0x000000000020C000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-93-0x0000000006AA0000-0x0000000006B56000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-85-0x00000000067D0000-0x0000000006808000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-84-0x0000000006C90000-0x0000000007236000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-83-0x0000000005F90000-0x0000000005FF6000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-82-0x0000000006300000-0x00000000066D4000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-123-0x000000000B880000-0x000000000B912000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-74-0x0000000005AB0000-0x0000000005B18000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-50-0x0000000005860000-0x00000000058B0000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-42-0x0000000001770000-0x000000000177E000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-114-0x0000000007730000-0x0000000007764000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-130-0x000000000B930000-0x000000000B938000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-131-0x000000000BD80000-0x000000000BD8E000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-110-0x00000000076D0000-0x00000000076EC000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-106-0x0000000006C80000-0x0000000006C90000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-102-0x0000000007690000-0x00000000076A6000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-98-0x0000000007540000-0x0000000007588000-memory.dmp
                                                                                                                          Download

                                                                                                                          memory/4852-200-0x0000000000140000-0x000000000020C000-memory.dmp
                                                                                                                          Download